Red Hat Security Advisory

RHSA-2026:63387

Satellite 6.17.11 Async Update

Released 2026-09-03 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Satellite 6.17 for RHEL 9 ansible-core-1:2.16.19-1.el9sat, ansible-test-1:2.16.19-1.el9sat, openvox-server-8.15.2-1.el9sat +3

Fixes 9 records

TI-2026-48269 CVE-2026-68494 · GHSA-r7wm-3cxj-wff9

Resource allocation without limits in FasterXML jackson-core

HIGH 77

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00463 Published 2026-08-04 Partial fix · 2.18.8, 2.21.4 +1 CWE-770

TI-2026-39358 CVE-2026-54512 · GHSA-j3rv-43j4-c7qm

jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

HIGH 70

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01066 Published 2026-06-23 Partial fix · 2.18.8, 2.21.4 +1 CWE-184

TI-2026-33154 CVE-2026-45363 · GHSA-c32j-vqhx-rx3x

`jwt` (Ruby gem) - empty-key HMAC bypass

MEDIUM 47

ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00364 Published 2026-07-14 Partial fix · 2.10.3, 3.2.0 CWE-1391

TI-2026-08808 CVE-2026-10051 · GHSA-f4v5-65jj-pcr2

Information disclosure in Eclipse Jetty

LOW 37

In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00429 Published 2026-07-14 Partial fix · 12.0.36, 12.1.10 CWE-200

TI-2026-13774 CVE-2026-16493 · GHSA-m37p-hmh2-w6j2

Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)

LOW 36

A flaw was found in ansible-core.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00268 Published 2026-07-21 Partial fix · 1:2.16.19-1.el9sat, 1.3.1-5.el9pc +1 CWE-88

TI-2026-09781 CVE-2026-11332 · GHSA-w8p5-mx5w-cpqj

Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

LOW 35

A flaw was found in ansible-core.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00222 Published 2026-06-05 Partial fix · 1:2.16.19-1.el8ap, 1:2.16.19-1.el9ap +33 CWE-88

TI-2026-48583 CVE-2026-69244 · GHSA-cq5v-8q36-5273

AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

LOW 32

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00528 Published 2026-08-03 Partial fix · 3.14.3 CWE-125

TI-2026-27214 CVE-2026-34993 · GHSA-jg22-mg44-37j8

AIOHTTP Vulnerable to Deserialization of Untrusted Data

LOW 31

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 3.1HIGH 7.3 Local Low privileges User interaction EPSS 0.00179 Published 2026-06-02 Partial fix · 3.14.0 CWE-502

TI-2026-48582 CVE-2026-69243 · GHSA-mfx4-hv73-q22v

AIOHTTP: HTTP request smuggling via WebSocket upgrade

LOW 28

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00443 Published 2026-08-03 Partial fix · 3.14.2 CWE-444